| From: | Michael Paquier <michael(dot)paquier(at)gmail(dot)com> |
|---|---|
| To: | Álvaro Hernández Tortosa <aht(at)8kdata(dot)com> |
| Cc: | Stephen Frost <sfrost(at)snowman(dot)net>, Robert Haas <robertmhaas(at)gmail(dot)com>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, "pgsql-hackers(at)postgresql(dot)org" <pgsql-hackers(at)postgresql(dot)org>, PostgreSQL JDBC List <pgsql-jdbc(at)postgresql(dot)org> |
| Subject: | Re: [HACKERS] Channel binding support for SCRAM-SHA-256 |
| Date: | 2017-06-21 00:16:38 |
| Message-ID: | CAB7nPqSKQL0Hxo-OHSibBYc+qsOTioaQvFaWJywBgjgrqG+3LA@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers pgsql-jdbc |
On Wed, Jun 21, 2017 at 4:04 AM, Álvaro Hernández Tortosa
<aht(at)8kdata(dot)com> wrote:
> In the coming weeks, and once my PR for pgjdbc has been added, I will
> work towards another patch to implement channel binding. Should be
> reasonably easy now, thanks to this.
So you basically have an equivalent of OpenSSL stuff in java, right?
- SSL_get_peer_certificate to get the X509 point of the server.
- X509_digest to hash it.
- OBJ_find_sigid_algs and X509_get_signature_nid to guess the
signature algorithm of a certificate. I think that this part can be
tricky depending on the SSL implementation, but I have designed a
generic API for this purpose.
That's all it took me to get end-point to work. Plus the error
handling of course.
--
Michael
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Michael Paquier | 2017-06-21 00:18:20 | Re: pg_bsd_indent 2.0 is available from git.postgresql.org |
| Previous Message | Haribabu Kommi | 2017-06-21 00:06:33 | Re: visual studio 2017 build support |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | albertwang | 2017-06-23 00:08:46 | Re: Streaming ResultSet |
| Previous Message | Álvaro Hernández Tortosa | 2017-06-20 19:04:24 | Re: [JDBC] Channel binding support for SCRAM-SHA-256 |